Microsoft Execution Containers are now generally available, and they tackle a problem every team using AI coding agents has felt. You want the agent to do real work, but you do not want it touching everything your login can touch. MXC puts the agent inside a boundary set by you, not by the agent.

Microsoft announced the release on October 7, 2026, in a post on the Windows Developer Blog by Logan Iyer, Corporate Vice President of Windows Platform and Developer. GitHub and Windows engineers followed with a deep dive on how Copilot uses it. In this guide, I will walk through what MXC does, where it fits and how agencies in India and the USA can try it without slowing delivery.

What Are Microsoft Execution Containers?

In Microsoft's words, MXC is a policy-driven execution layer for untrusted code or dynamically generated workloads. In plain terms, it is a fence around the agent. You decide which files and network locations the agent can use, and MXC enforces that at runtime.

The important part is who holds the keys. The policy sits outside the agent's control. The agent, its plugins and the code it writes cannot grant themselves more access.

You can wrap different layers with MXC:

The output a model generates, such as a script it wants to run
Plugins and tools the agent calls
The agent harness that drives the loop
The entire agent, end to end

Developers describe what a workload needs in one JSON configuration schema and use a multi-language SDK. MXC then maps those needs to the right container on Windows, macOS or Linux. The SDK, schema, docs and samples are in the MXC repository on GitHub.

Why AI Agents Need a Boundary They Cannot Move

Microsoft's post makes a simple point: an agent cannot be its own security authority. Its limits must be set by the developer or the company and enforced separately from the agent.

Their example will feel familiar to any web agency. A coding agent is asked to update a website. It needs to read and write the repo and run build tools. It may need to read the production server config, but it should never change it.

Without a fence, the agent might decide that editing the server config is the fastest fix. That choice can look sensible to the agent and still break the live site. With MXC, the write is blocked no matter what the model or its tools decide.

This is the same risk the OWASP project calls excessive agency in LLM applications. Agents get more permissions or freedom than the task needs, and small mistakes turn into big ones. We covered a related case in our post on AI agent security after the Meta Muse VM escape.

Logos of partners building on Microsoft Execution Containers, including Anthropic, OpenAI, NVIDIA, Replit and Perplexity — Partners building on MXC. Image: Microsoft, via the Windows Developer Blog.

The Four Microsoft Execution Containers Types

Not every job needs the same level of isolation. A coding agent wants speed. An agent handling sensitive data or unknown code needs a thicker wall. MXC offers four backends:

Container	Where it runs	Best for
Process container	Windows 11, macOS, Linux	Fast, light work such as running generated code and tools
Session container	Windows 11 only	Long-running agents that need their own desktop
WSL container	Windows 11 only	Linux-first toolchains and packages
MicroVM	Windows 11 and Linux (experimental)	Higher-risk jobs that need hardware-backed isolation

The process container uses each system's own sandbox. That means AppContainer on Windows, Seatbelt on macOS and Bubblewrap on Linux.

The session container is the most interesting one for desktop automation. It runs the agent under a separate Windows account and session. Its desktop, clipboard, UI and input are kept apart from yours, so the agent cannot quietly read what you copy.

Microsoft also notes that Windows 365 support for MXC is generally available. Teams can run agents on Cloud PCs next to their normal work, which helps when laptops vary across a team.

What an MXC Policy Controls

An MXC policy covers five areas. Think of them as the questions you answer before the agent starts:

Containment: which type of container the workload runs in.
Process: the command, arguments, working folder and environment used to start it.
File system: folders it can change, folders it can only read and folders it cannot see.
Network: inbound and outbound connections, including access to local services.
User interface: whether it can see or use the desktop.

For the website example, a policy could allow read and write on the project repo and access to Git. It could block the user's Documents folder, all network traffic and the desktop. That is a clean, least-privilege setup.

Companies can add their own rules on top. Microsoft says Intune policy will soon manage MXC process containers on Windows 11. So the same agent can follow a stricter boundary at a bank client and a looser one in your own sandbox, without code changes.

Learning, Permissive and Enforcement Modes

Writing a tight policy is hard when you do not yet know what the agent needs. MXC helps with three modes:

Enforcement: the production setting. Anything outside the policy is blocked, with no activity report.
Learning: still blocks anything not granted, but records each blocked attempt in a JSON activity report.
Permissive: allows the action but records what the policy would have denied.

The activity report is only available for process containers on Windows. It is still a big help. You can run an agent through a normal sprint task, read the report and grant only what it truly used.

Microsoft also gives agent builders a clear rule. If a policy blocks something, the agent should explain why the task could not finish, ask for the right approval or pick a safe alternative. It should not fail silently. If your agency builds custom agents for clients, put that rule in your acceptance criteria.

How GitHub Copilot Uses Microsoft Execution Containers

The clearest real-world example comes from GitHub. In a post on Microsoft's Command Line blog about local models and sandboxed tools, Patrick Nikoletich of GitHub and Stuart Schaefer of Microsoft explain the setup.

They start with a point many teams miss. An agent's shell commands normally inherit all the access of the account running them. Running the model on your own laptop does not change that.

Here is how Copilot handles it:

On Windows it uses the BaseContainer tier of the process container. On macOS it uses Seatbelt, and on Linux it uses bubblewrap.
With sandboxing on, shell commands run inside the boundary. By default, local MCP servers and language servers do too.
Built-in file tools run inside Copilot itself. Copilot checks them against the policy, but GitHub says those checks are not OS-enforced.
Remote MCP servers sit outside the local sandbox.

In the Copilot CLI, the /sandbox command opens the settings. In the Copilot app, a "Sandbox new sessions" toggle turns it on per project. The working folder stays read and write, while most of the system is read-only or hidden.

That fine print matters. A sandbox covers what it covers, and no more. When you review a tool, ask exactly which parts run inside the boundary.

Surface laptop beside the words Local Models, from Microsoft's post on sandboxed tools in GitHub Copilot — GitHub and Windows are pairing local models with MXC sandboxing. Image: Microsoft Command Line blog.

Which AI Tools Support MXC?

According to Microsoft, these tools already support MXC:

GitHub Copilot
OpenAI Codex
Replit
OpenClaw
LM Studio
Unsloth AI

Support is on the way from Anthropic Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast and Simular, among others. NVIDIA has also built its OpenShell into MXC. That adds controls for file and inference access, network rules, credential management and OCSF audit logs for enterprises.

One more piece is listed as coming soon. Microsoft Entra will be able to tell agent activity apart from user activity in Microsoft Agent 365. That means security teams could cut off one misbehaving agent without locking out the employee using it.

What Microsoft Execution Containers Mean for Agencies in India and the USA

At Debugged Pro, we see the same pattern across client projects. Developers want agents for boilerplate, tests and refactors. Clients want proof that their code and data stay safe. MXC gives you a concrete answer to that second worry.

A few practical wins stand out:

Easier security reviews. You can show a client the exact policy an agent runs under, not just a promise.
Client separation. Lock each agent session to one client repo, so one project never leaks into another.
Mixed laptops. One policy format covers Windows, Mac and Linux machines on the same team.
Audit trail. Learning mode reports give you evidence of what an agent tried to touch.

This matters for teams on both sides of the world. Indian delivery teams often work under strict data clauses from US clients. US agencies handle health, finance and legal data with their own rules. In both cases, a hard limit on agent access is easier to defend than a written policy alone.

MXC is not the only option. AWS recently shipped its own take, which we covered in our guide to the AI agent sandbox in AWS Strands Box. Strands Box is macOS only for now, while MXC spans three operating systems. It is worth knowing both.

A Simple Rollout Plan for Your Team

You do not need a big program to start. Here is a plan a small team can run in two weeks:

Pick one agent and one repo. GitHub Copilot is the easiest start, since it already supports MXC.
Turn on sandboxing. Use the project toggle in the Copilot app or the /sandbox command in the CLI.
Run in Learning or Permissive mode. Let developers work normally for a week.
Read the activity report. List every file path and network call the agent needed.
Write a tight policy. Grant only those resources. Block personal folders and production configs.
Switch to Enforcement. Note any task that breaks and decide if the access is truly needed.
Write it down. Add the policy to your client security pack and onboarding docs.

Keep secrets out of reach from day one. API keys, cloud credentials and SSH keys should never sit in folders the agent can read.

If you want help setting up agent workflows like this, our software development consulting team works with businesses in India and the USA on safe AI tooling and delivery.

Key Takeaways

Microsoft Execution Containers (MXC) became generally available on October 7, 2026.
MXC enforces limits on AI agents that the agent itself cannot change.
Four container types cover light coding work up to hardware-isolated MicroVMs.
Learning and Permissive modes help you build a least-privilege policy from real usage.
GitHub Copilot, OpenAI Codex and Replit already support it, with Claude Code and others on the way.
Start small: one agent, one repo, one week of learning, then enforce.

Frequently Asked Questions

What are Microsoft Execution Containers?

Microsoft Execution Containers, or MXC, is a policy-driven layer from the Windows team for running untrusted or AI-generated code. Developers list the files, network access and other resources a workload may use, and MXC enforces those limits with a container. The agent cannot change the policy itself.

Is MXC only for Windows?

No. The process container works on Windows 11, macOS and Linux. It uses AppContainer on Windows, Seatbelt on macOS and Bubblewrap on Linux. The session container and the WSL container are Windows 11 only, and the MicroVM option is experimental on Windows 11 and Linux.

Which AI tools support MXC today?

Microsoft says GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio and Unsloth AI already support it. Anthropic Claude Code, Box, Egnyte, Heidi Health, Hermes Agent by Nous Research, Manus, Perplexity, Raycast and Simular are among those adding support.

Does MXC cost anything?

Microsoft describes MXC as an open-source library, and the SDK, configuration schema, documentation and samples are on GitHub. Your costs depend on the tools around it, such as Windows 365 Cloud PCs or Intune licences.

How should an agency start with MXC?

Pick one coding agent that already supports it, such as GitHub Copilot. Turn on sandboxing for one project, run in Permissive or Learning mode for a week, review what the agent tried to reach, then switch to Enforcement with a tight policy.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He works with development teams that build software for clients in India and the USA. He tracks the AI tools those teams use every day. He writes clear, practical guides so teams know what changed and what to do next.